Prevent sandbox escape via 'BaseRequest.traverseName'.

Fixes LP #1095343.
zopefoundation · Jul 5, 2013 · aa498e1 · aa498e1
1 parent 35cd714
commit aa498e1
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 0 deletions.
diff --git a/doc/CHANGES.rst b/doc/CHANGES.rst
@@ -8,6 +8,8 @@ http://docs.zope.org/zope2/
 2.13.21 (unreleased)
 --------------------
 
+- LP #1095343:  prevent sandbox escape via ``BaseRequest.traverseName``.
+
 - LP #1094144:  prevent arbitrary redirections via faked "CANCEL" buttons.
 
 - LP #1094221: add permissions to some unprotected methods of

diff --git a/src/ZPublisher/BaseRequest.py b/src/ZPublisher/BaseRequest.py
@@ -346,6 +346,7 @@ def traverseName(self, ob, name):
             ob2 = adapter.publishTraverse(self, name)
 
         return ob2
+    traverseName__roles__ = ()
 
     def traverse(self, path, response=None, validated_hook=None):
         """Traverse the object space